Abstract:
—Breach in password databases has been a frequent phenomena in the software industry. Often these breaches go
undetected for years. Sometimes, even the companies involved are not aware of the breach. Even after they are detected, publicizing
such attacks might not always be in the best interest of the companies. This calls for a strong breach detection mechanism. Juels et al.
(in ACM-CCS 2013) suggest a method called ‘Honeywords’, for detecting password database breaches. Their idea is to generate
multiple fake passwords, called honeywords and store them along with the real password. Any login attempt with honeywords is
identified as a compromise of the password database, since legitimate users are not expected to know the honeywords corresponding
to their passwords. The key components of their idea are (i) generation of honeywords, (ii) typo-safety measures for preventing false
alarms, (iii) alarm policy upon detection, and (iv) testing robustness of the system against various attacks.
In this work, we analyze the limitations of existing honeyword generation techniques. We propose a new attack model called
‘Multiple System Intersection attack considering Input’. We show that the ‘Paired Distance Protocol’ proposed by Chakraborty et al., is
not secure in this attack model. We also propose new and more practical honeyword generation techniques and call them the
‘evolving-password model’, the ‘user-profile model’, and the ‘append-secret model’. These techniques achieve ‘approximate flatness’,
implying that the honeywords generated using these techniques are indistinguishable from passwords with high probability. Our
proposed techniques overcome most of the risks and limitations associated with existing techniques. We prove flatness of our
‘evolving-password model’ technique through experimental analysis. We provide a comparison of our proposed models with the
existing ones under various attack models to justify our claims.
